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ABSTRACT 



Fault Tree Analysis is a method implemented through the 
use of logic symbols, for analyzing either qualitatively or 
quantitatively the events that lead to a mission or system 
failure. This work examines an Anti-Aircraft Warfare (AAW) 
scenario restricted to the defense of an aircraft carrier. 

A fault tree of the events that lead to a hit on the carrier 
is displayed logically from the top down. Fault tree anal- 
ysis when applied to the AAW model is examined with a view 
toward its usefulness as an instructional and a predictive 
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I . INTRODUCTION 



A. BACKGROUND 

The application of Fault Tree Analysis (FTA) to commer- 
cial and military systems has been ongoing for several de- 
cades. It has been used to one degree or another in industries 
such as aerospace, electronics, chemical processing, nuclear 
reactor containment, construction and transportation. It 
has evolved from a method for the design and diagnosis of 
safe systems to one that also has applicability in Reliabil- 
ity Engineering. The more general term. Event Tree Analysis, 
refers to a method for examining the events that lead to either 
mission success or mission failure. The more restrictive 
term. Fault Tree Analysis, refers to a failure oriented anal- 
ysis. Hence the top event in a fault tree has generally an 
event description that depicts mission or system failure. 

Most of the events in a fault tree that support and contri- 
bute to the top events are undesirable ones and are appro- 
priately named faults. 

With minor modifications to the conventional symbology 
used in current FTA, the objective of this work is to pro- 
vide a model of an Anti-Aircraft Warfare (AAW) scenario from 
a mission failure (or defensive) point of view. 

It should be emphasized that the methodology used in this 
paper has the potential for use in other scenarios either 
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operational or non-operational . In the broader sense of Event 
Trees / the potential to analyze not only mission failure but 
the more positive side, mission success appears to be unlimited 
The results can be used as both a quantitative predictive 
and a qualitative instructional tool. 

The inherent objective in Fault Tree Analysis is to pro- 
vide an in depth analysis that is understandable by others. 

This requires that the modelor (or analyst) completely spe- 
cify the combinations of events occurring in the system, and 
how they lead to the top event through a logical use of sym- 
bols and graphs. 

In FTA one of the quantitative goals is to compute an 
overall probability of mission success or failure. Simply 
stated, FTA will predict the occurrence cf the top event with 
a certain probability. The AAW model examined in this work 
is not used as a quantitative predictor but instead examines 
in a qualitative manner the events that lead to mission failure 

As a qualitative tool FTA provides a method when properly 
used, that could lead to the discovery of events or combina- 
tions of events that may not have otherwise been recognized 
as causes of the event being analyzed. For further discussion 
and treatment of the use of Fault Tree Analysis it is suggested 
that the reader consult the articles contained in Barlow, 
Fussell and Singpurwalla , [Ref. 1] , and cited in Barlow, [Ref. 
2 ] . 
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B. THE AMTI-AIRCRAFT WARFARE MODEL 

The tactical importance of anti-aircraft warfare makes 
it a logical choice as a topic for Fault Tree Analysis. In 
addition, an abundance of information consistent with cur- 
rent tactical thinking on the AAW problem is readily avail- 
able and adaptable to FTA. Simply stated, the AAW problem 
concerns the destruction of enemy air platforms and airborne 
weapons whether launched from surface, sub-surface or air 
platforms. The model considered in this work is for the AAW 
problem restricted to air platforms that launch missiles 
against U.S. naval aircraft carriers and their escorts. The 
problem scope now becomes the defense of an aircraft carrier 
against long range bombers (LRB's) that launch long range 
air-to-surface missiles (ASM's). In order to reduce the pro- 
blem to one that is manageable, the normally assumed 360 degree 
circle of protection that is required about the carrier now 
becomes a smaller sector of undefined size where one-on-one 
engagement analysis is performed. This is not an unreasonable 
assumption with the state of alertment associated with today's 
early warning detection systems and military intelligence 
systems. Applying fault tree methodology from the defensive 
point of view, the top event corresponds to the aircraft car- 
rier being hit by one air-to-surface missile (ASM) launched 
from a long range bomber (LRB) at some standoff launch range. 
The aircraft carrier is protected in the sector by airborne 
early warning aircraft, long range combat air patrol aircraft 
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(CAP) and medium range CAP, a long range surface-to-air mis- 
sile (SAM) ship, a short range SAM ship and the carrier's 
own self defense system (commonly called point defense sys- 
tem) . By convention the model is developed "top down" through 
the contributory events that build to a hit on the carrier. 
During application however, the flow of occurrences through 
the logic gates is directed upward. 

C. SUMMARY 

In summary, this paper examines a modified version of 
Fault Tree Analysis applied to an Anti-Aircraft Warfare sce- 
nario. The features of event tree analysis are examined with 
a look toward both quantitative and qualitative application. 
Finally an examination of how this methodology may be used 
in other operational or non-operational scenarios is conducted. 
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II. EVENT TREE CONSTRUCTION 



A. EVENT SYMBOLOGY 

The top event in a fault tree is generally some undesired 
system state resulting from a combination of undesired sub- 
system states. Since the tree is developed top down, the 
top event must be carefully and thoughtfully defined and then 
the tree developed by modelors or analysts who have a fairly 
detailed understanding of the system and who can translate 
that knowledge into a graphical representation. 

The methodology for Fault Tree Analysis that has been 
adopted in this paper is a simplification of the standard 
methodology found in current works on Fault Tree Analysis. 
Specifically, the symbology used in Barlow and Lambert, [Ref. 

3] , and Young [Ref. 4] , has been modified for the convenience 
of using computer generated graphics to display the AAW model. 
The EVENT symbology used in this work does not alter the logic 
or the event sequence associated with the symbology cited 
in the references. Although it replaces the use of the four 
event symbols in Figure 2.1 by a single symbol, the rectangle, 
used to display all events in the model, no information is 
lost in this representation. Within the rectangle an undesired 
system state is defined. Whether or not it is classified 
as a primary event, a secondary event, an undeveloped event 
or a switch event is not important in the application presented 
here . 
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o 

FAULT EVENT PRIMARY UNDEVELOPED SWITCH 

or or or EVENT 

INPUT EVENT BASIC EVENT SECONDARY EVENT 

or 

OUTPUT EVENT 
or 

SUCCESS EVENT 

Figure 2.1 FTA SYMBOLOGY 
B. LOGIC SYMBOLOGY 

The two most often used symbols to connect the contri- 
butory events to the top event are the two logic gates, the 
AND gate and the OR gate. In a mathematical sense the AND 
gate represents set intersection while the OR gate represents 
set union. In Figure 2.2 undesired Event One will result 
only if Event Two and Event Three and Event Four occur. Event 
One is the result of transmitting Events Two, Three and Four 
through the AND gate. To illustrate the use of the OR gate, 
undesired Event Five will result if at least one of the events. 
Six, Seven or Eight occur . ^ By transmitting Events Six, Seven 
and Eight through the OR gate. Event Five will result. The 
tree is structured so that all events lead sequentially and 





The symbology used here follows closely the symbology 
used in current work with the exception that some modelors 
use a combinatorial OR gate such as 1 out of 3, or 2 out of 
4, etc. 
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logically to the top event, and all are related to the top 
event by A^7D and OR gates. 




AND OR 

Figure 2.2 LOGIC SYMBOLOGY 



C. SUCCESS TREE VERSUS FAULT TREE 

The term "success tree" to which prior reference has not 
been made is another application of event tree analysis that 
can result in a better understanding of the system being anal- 
yzed. To contrast the use of success trees and fault trees, 
consider the Initial Scenario proposed in the illustration 
below. The illustration forms the basis for the AAW model 
examined later . 

The Initial Scenario can be stated as follows: The carrier 
is attacked by a single aircraft. The aircraft attempts to 
close to a range which permits the launch of its one air- 
to-surface missile. The Initial Scenario is displayed in 
Figure 2.3. 

From a defensive point of view the modelor could apply 
either of the two methods. Fault Tree Analysis or Success 
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Tree Analysis to logically symbolize the events that lead 
to the top event. His choice may be purely one of prefer- 
ence or there may be underlying assumptions that would cause 
him to choose one method over the other. To illustrate the 
dual relationship that exists between the two trees, consider 
the events that are displayed in Figures 2.4 and 2.5. These 
figures develop the tactical scenario displayed in Figure 
2.3. 




Figure 2.3 INITIAL SCENARIO 



Figure 2.4 shows a success tree, with application of the 
OR gate. It relates a top event which is favorable to the 
defense to the contributing favorable events. 

Figure 2.5 shows a fault tree, with application of the 
AND gate. It relates a top event which is unfavorable to 
the defense to contributing unfavorable events. 

In addition to providing graphic representation of suc- 
cess tree versus fault tree methodology, the "dual analysis" 
displayed in Figures 2.4 and 2.5 illustrate the simple manner 
in which the OR gate and the AND gate can be used interchange- 
ably by negating the top event (or any fault/success event) . 




Figure 2.4 SUCCESS TREE WITH OR GATE APPLIED 
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The Initial Scenario and the contributing examples are 
extracted from unpublished notes by J.D. Esary, Professor 
of Operations Research and Statistics, Naval Postgraduate 
School. The probability analysis of Appendix A is extracted 
from the same notes. 




Figure 2.5 FAULT TREE WITH AND GATE APPLIED 
D . IMP LEMENT AT I ON 

The model examined in this work uses Fault Tree meth- 
odology while using the symbology similar to that indicated 
in Figures 2.4 and 2.5. The most notable difference is that 
both the AND and OR gates are represented by one shape and 
that shape is rotated 180 degrees from those of Figures 2.4 
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and 2.5. This shape will become familiar in the next chapter. 
Since the model is too large to fit on one sheet of standard 
size paper, "off page" connectors are used to continue the 
model on subsequent pages. The off page connector, a small 
circle with the connector page number located inside, is eas- 
ily located on each page of the model. Logic gates and off 
page connectors used throughout this work are displayed in 
Figure 2.6. 




LOGIC GATES OFF PAGE CONNECTORS 



Figure 2.6 LOGIC GATES AND OFF PAGE CONNECTORS 
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III. FAULT TREE MODEL 



A. DEFENSE IN DEPTH 

Although the objective of this work is not to examine 
the tactics used by a modern naval combatant task force against 
a long range bomber/antiship missile threat, an under- 
standing of the defensive concepts used in such a scenario 
will assist in the understanding of the model. 

The air defense of the U.S. naval battle group is cen- 
tered on the aircraft carrier and is based on the aggregate 
support from all of the elements in the group. This concept 
is called defense- in depth. Three zones of defense are used 
to describe defense in depth. Various weapons systems are 
employed at different ranges to prevent the penetration of 
enemy platforms (Long Range Bombers or ASCM's). The defensive 
barriers that are implied here are created by long range and 
medium range CAP aircraft in the Outer Defense Zone; by long 
range and short range SAM ships in the Inner (or Area) Defense 
Zone; and by the individual ships point defense systems in 
the Self Defense Zone. The geographical boundaries to each 
zone have been generally defined and are based on the maximum 
ranges of the various weapons systems. With modern weapons 
systems the ranges become somewhat flexible and in many cases 
overlap. This is especially evident when one considers the 
maximum range of the air intercept missiles (AIM's) used by 
fighter aircraft versus the range of the LR SAM. 
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The problem with overlapping weapons coverage is truly 
a dynamic one that results in subsequent weapons allocation 
problems. When one considers the speed of the incoming ASCM, 
this problem becomes even more evident. Once the ASCM is 
detected, very little time remains to decide on the best meth- 
od to counter the penetrator. This problem exists not only 
in the inter zone sense (CAP vs LR SAM for example) but also 
in the intra zone sense (which CAP or LR SAM platform to as- 
sign) . For the AAW scenario the task of assigning weapons 
to ASCM (or LRB) is the responsibility of the ANTI-AIR WAR- 
FARE COMMANDER. The problem becomes more severe when electronic 
warfare measures are employed by both the offensive and defen- 
sive platforms to degrade the opponent's use of electromagnetic 
radiation . 

Outer Air Defense Zone tactics are designed to allow outer 
air defense forces to detect and destroy antiship cruise 
missile (ASCM) platforms (LRB's) before the launch of the 
ASCM. Accompanying the long range bombers are electronic 
jamming aircraft, commonly called STRIKE SUPPORT aircraft, 
that provide electronic support and protection of the LRB's 
at STANDOFF ranges. Outer defense zone tactics further in- 
clude the destruction of these platforms. The scenario modeled 
in this work does not explicitly include the attempt to knock 
down these platforms, however the jamming provided by the 
strike support aircraft is modeled. 
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Since the primary objective of the LRB is to target the 
carrier and subsequently launch an ASCM, the advantageous 
position from which to do this is at the maximum range from 
the task force. The LRB thereby reduces time in which he 
is exposed to the task force CAP aircraft. This range gen- 
erally corresponds to the maximum range of the ASM and is 
termed the STANDOFF launch range . 

The LRB uses active radar to accomplish this task, an 
active radar that may be vulnerable to electronic counter- 
measures by members of the battle group. The term that is 
applied to the use of electronic countermeasures by the bat- 
tle force is COUNTERTARGETING. As the term implies, COUNTER- 
TARGETING is the use of active or passive jamming to reduce 
the range at which the long range bomber can accurately de- 
tect and target the aircraft carrier. 

What we have seen in the Outer Air Battle is a reduction 
in the number of standoff jammers with the use of CAP air- 
craft. The attrition of standoff jammers is essential to 
the defense of the carrier if the battle group radars are 
expected to detect ASM platforms before cruise missile launch. 
Outer air battle forces thus reduce the number of attackers 
that penetrate to the Inner Defense Zone. Finally, the outer 
air forces are used to destroy loitering or retiring long 
range bombers so that follow-on raids are less severe. 

Before proceeding, it may be advisable to consider the 
tradeoffs that exist in the Outer Air Battle when offensive 
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and defensive electronic countermeasures are employed. The 
offensive LRB prefers to target the carrier at maximum stand- 
off range in order to launch the ASM (which needs no further 
guidance from the bomber once launched) . The LRB thus re- 
duces his exposure to the layered defensive forces. The trade- 
off here stems from the fact that at maximum standoff range 
the targeting problem is more severe than at reduced ranges 
where targeting solutions are more accurate. Thus the effec- 
tiveness of his attack is reduced. Conversely the defensive 
forces, or battle group, use electronic means to increase 
the targeting problem and thereby force the bombers to pro- 
ceed to ranges more precarious to their survival. More im- 
portantly, the probability that an ASCM is launched is reduced. 

In the Area Defense Zone long range and short range sur- 
face-to-air missiles are employed to destroy penetrating ASCM's. 
Electronic countermeasures are used to deceive the ASCM's. 
Depending on the effectiveness of the countertargeting, an 
additional problem of command and control exists with over- 
lapping engagement zones. CAP-SAM coordination is necessary 
to prevent engagement of defender-on-defender. The coordi- 
nation of inner defense weapons is necessary to prevent over- 
engagement of one target while others remain unengaged. Thus 
real-time management of weapon resources is mandatory in the 
hostile environment created by the launch of an ASCM. 

The Self Defense Zone constitutes the final barrier in 
the defense of the carrier. This zone employs point defense 
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systems (missiles or guns) that have high kill probabilities 
to destroy the ASCM's that have penetrated the outer zones. 

B. ASSUMPTIONS 

The AAW model examined in this work uses the defense in 
depth concept to describe the events that lead to a hit on 
the carrier. Prior to the assembly and description of the 
fault tree, it may prove useful to describe the tactical and 
strategic assumptions that were used to design the model. 

The assumptions are: 

• Carrier battle group is attacked by long range 
bombers in open ocean transit. 

• Antiship cruise missile is autonomous after 
launch; no midcourse update or corrections are 
necessary from the mother aircraft. 

• Antiship cruise missile flight profile is high 
altitude in the cruise phase and steep angle of 
attack in the dive phase . 

• All defensive forces are modern platforms that 
are equipped with the latest variant of Navy 
Tactical Data System (NTDS) . 

• Outer air battle forces are comprised of Early 
Warning (AEW) and fighter aircraft using vector 
logic techniques for detection, tracking and 
engagement of hostile platforms. 
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• Although there may be many LRB's in the raid 
that attack the carrier, this analysis deals 
with only one small sector close to the threat 
axis . 

• Each LRB has only one ASCM. 

• Salvo doctrine for the defensive forces is im- 
plicit and imbedded in the fault tree; i.e., how 
many missiles it takes to hit the ASCM is not 
important, just that the event did or did not 
happen . 

• Approximate threat axis is known. 

• Area defensive forces are NTDS equipped. 

• Long range missile ship employs Terrier missile 
system to intercept the ASCM. 

• Short range missile ship employs Tartar mis- 
sile system to intercept the ASCM. 

• LR SAM ship is positioned for cruise phase inter- 
cept of the ASCM. 

• SR SAM ship is positioned for dive phase inter- 
cept of the ASCM. 

• LR and SR SAM ships have electronic warfare suites 
permitting countertargeting techniques. 

• Composite Warfare Commander (CWC) doctrine is used. 

• Countertargeting, when effective, is only effective 
in the Outer Defense Zone. 



26 



• Some probability exists for a LR/MR CAP to 
intercept the high altitude ASCM with CAP-fired 
air intercept missiles (AIM's). 

C. THE MODEL (EXPANDED VERSION) 

Since the model was developed top down to conform to the 
convention in Fault Tree Analysis, the top event is assigned 
"Carrier is hit". As previously discussed it is the major 
event to which all subevents subscribe . To get an overview 
of the events that must be further developed the following 
analysis is provided. 

The event "CARRIER IS HIT" is a result of; 

• Missile penetrates point defense systems. 

• Missile penetrates short range SAM ship defense. 

• Missile penetrates long range SAM ship defense. 

• Missile penetrates LR/MR CAP defenses. 

• Missile launched from long range bomber. 

• Countertargeting is effective, LR bomber penetrates 
LR/MR CAP defenses to reduced launch range. 

OR 

Countertargeting is ineffective; LRB penetrates 
LR/MR CAP defenses to standoff launch range. 

The events listed above are the major subsections of the 
model. Figure 3.1 displays these major events by block dia- 
gram. Developing the sub events that appear in Figure 3.1 
and applying fault logic to the model is the next step in 
the procedure. 
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Figure 3.1 BLOCK DIAGRAM 
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D. HOW TO READ THE MAJOR SUBEVENTS 

The block diagram presented in Figure 3.1 was used as 
a starting point to gain an overall appreciation for the model. 
An expanded version of the model with fault tree symbology 
applied is presented in Figure 3.2 and continued in Figure 
3.3. The model was developed from the block diagram using 
a "tiered" approach. Each tier represents a combination of 
subevents that are linked together with logic gates. Each 
tier is in actuality composed of many subevents but only the 
major events are displayed in Figures 3.2 and 3.3. The num- 
bers that appear in parentheses adjacent to each block (or 
group of blocks) in Figure 3.1 correspond to the tiers in 
Figures 3.2 and 3.3. The tiers are correspondingly numbered 
also. The tiers represent specific levels of defense through 
which the ASCM must penetrate. 

Applying this nomenclature and using the Defense in Depth 
concept, block (1) in Figure 3.1 relates to the Self Defense 
Zone. This corresponds to tier (1) in Figure 3.1. Similarly, 
blocks (tiers) (2) and (3) represent the Area Defense Zone 
and blocks (tiers) (4) through (6) relate to the Outer Defense 
Zone . 

1 . First Tier 

The Self Defense Zone of the carrier is developed 
from the primary fault event of the tree or the top event. 

The event "Carrier is hit" results from two events that com- 
prise the first tier of the model. The ASCM must first 
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penetrate the POINT DEFENSE system of the carrier and the 
ASCM must function properly in the terminal (homing) de- 
scent phase. 

It should be noted that the model presented here is 
a one sided model, because the events displayed represent 
only the faults of the defensive force (the battle group) . 

With few exceptions, the faults (or successes) of the offen- 
sive force are not presented. One instance that is contrary 
to this convention occurs in the first tier. The event "ASCM 
systems function properly" is a major offensive force event. 

2 . Second Tier 

ASCM penetration of the carrier SELF DEFENSE ZONE 
is a result of two major subevents: (a) the missile has pen- 

etrated the SR SAM ship DEFENSE ZONE and (b) the missile has 
evaded the carrier's Point Defense Zone. Event (b) does not 
appear in Figure 3.2. It is the implicit combination of two 
events that are connected through a logic gate. The evasion 
of the carrier's point defense system is a result of the union 
of two events: either (bl) carrier fires it's point defense 
system at the ASCM and misses or (b2) the carrier does not 
fire . 

3 . Third Tier 

Tier (3) represents the final tier in the Inner Defense 
Zone. The penetration of the ASCM through the SR SAM ship 
defense is a result of transmitting the event "ASCM penetrates 
through LR SAM ship defense" and ASCM evasion of the SR SAM 
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Figure 3.2 MAJOR SUBEVENTS 
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ship defense through an AND gate. ASCM evasion of the SR 
SAM ship defense is not an explicit event in Figure 3.2 but 
a combination of two events that are connected by an OR gate: 
either (a) the SR SAM ship fires and misses or (b) the SR 
SAM ship does not fire. 

4 . Fourth Tier 

The penetration of the ASCM through the LR SAM ship 
defense is a result of ASCM penetration through the CAP de- 
fenses and the intersection of ASCM evasion of LR SAM ship 
defense indicated in Figure 3.3. The latter event is a com- 
bination of two events; (a) LR SAM ship fires a LR SAM and 
misses or (b) LR SAM ship does not fire. These events are 
transmitted through an OR gate. 

5 . Fifth and Sixth Tiers 

ASCM penetration to the Inner Defense Zone is a re- 
sult of many fault events in the Outer Air War. To put it 
into perspective, return to Figure 3.1. The ASCM is launched 
from a long range bomber at a position within the maximum 
range of the ASCM after the mother aircraft has gained accu- 
rate targeting information on the carrier. Depending on the 
effectiveness of the countertargeting efforts of the battle 
force, the ASCM will be launched either from a STANDOFF launch 
range or from a REDUCED launch range. 

Return now to Figure 3.3. At tier (4), ASCM pene- 
tration through the CAP defenses is a result of connecting 
the essential event of tier (5) "ASCM is launched from REDUCED 
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Figure 3.3 MAJOR SUBEVENTS 
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launch range" with the essential event of tier (6) "ASCM is 
launched from STANDOFF launch range". These tiers are con- 
nected by an OR gate. Tiers (5) and (6) are further devel- 
oped in Figure 3.3. Referring to tier (5), once launched, 
the ASCM must evade the CAP-fired AIM's. The two events (a) 
"ASCM is launched from a REDUCED launch range" and (b) "ASCM 
evades LR/MR CAP defense" are connected by an AND gate. The 
ASCM is launched from REDUCED launch range because the events 
"COUNTERTARGETING ..." and "LR bomber evades LR/MR CAP defenses 
are transmitted through an AND gate. 

A parallel analysis can be seen in tier (6) for the 
ASCM launched at STANDOFF range . 
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IV. THE DETAILED MODEL 



Chapter III presented the AAW model in an expanded ver- 
sion. A tiered approach was developed to gain an apprecia- 
tion for the construction of the model. The intention in 
the present chapter is to detail the model. 

A. SELF DEFENSE (TIER 1) 

The fault events that contribute to the penetration of 
the ASCM through the self defense system of the carrier are 
displayed in Figure 4.1. The primary difference between the 
events of Figure 4.1 and those of Figure 3.2 is the expansion 
of the major subevent in Figure 3.2: "Carrier fires ... and 
misses". Three events connected by an AND gate describe this 
event. Consider the first event (reading left to right). 

In order to fire the ASCM there must be a fire control solu- 
tion generated on the carrier. Once the solution is found 
by the fire control system (block 2) , the carrier fires at 
the ASCM and misses. 

The events that lead to a fire control solution are pre- 
sented in Figure 4.2. The events are connected to Figure 
4.2 by the "fcs" off page connector. Events similar to those 
of Figure 4.2 are used throughout this work since a fire con- 
trol solution must be performed prior to firing any weapon. 
Conceptually there is little difference in generating a fire 
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Figure 4 . 1 ASCM PENETRATES SELF DEFENSE SYSTEM 
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control solution whether on the carrier or on another NTDS 



equipped vessel. Furthermore, although the details of this 



analysis imply NTDS, the development is general enough to 



use for non-NTDS equipped platforms. 




Figure 4.2 FIRE CONTROL SOLUTION GENERATED 



The blocks enclosed by the dashed line in Figure 4.2 are 
read as follows: a target has been designated "hostile" by 
some other unit (AEW, LR SAM SHIP, CAP) ; the target is de- 
tected by the carrier's radar and and the symbol that appears 
on the NTDS console (visual display) matches the hostile 



37 




designation. A fire control system (there may be more than 
one) on the carrier is designated to perform the task of firing 
the weapon at the ASCM. The fire control system "acquires" 
the target and then "tracks" the target. Finally, a "solution" 
to the intercept problem (Point Defense versus ASCM) is com- 
puted. All of the events that are enclosed by the dashed 
line must happen in order to close the loop, therefore the 
events are connected by an AND gate. 

Detection of the target with a ship's own radar is con- 
strained by the electronic measures taken by the STRIKE SUPPORT 
aircraft. In order to detect the target, either "No ECM is 
conducted ..." or "ECM is conducted ...". If the latter is 
the case then ECM is countered by the self defense system. 

These events are displayed in Figure 4.2. 

The event "carrier point defense system does not fire" 
in Figure 4.1 is supported (via the "cpds" connector) by events 
displayed in Figure 4.3. The system does not fire for one 
of several reasons; either (1) the "Fire control (FC) solu- 
tion is not generated" or (2) the "FC solution is generated 
but a command and control problem prevents firing" or (3) 
the "fire control solution is generated and the launcher 
malfunctions" . 

The FC solution events in Figure 4.3 are supported by the 
events displayed in Figure 4.4. The hostile target is 
not engageable because (a) either the target is out of the 
engagement envelope of the fire control system (unlikely in 
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Figure 4 . 3 CARRIER POINT DEFENSE SYSTEM DOES NOT FIRE 
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this case since the ASCM's goal is to hit the carrier) or 
(b) the detection of the ASCM is gained late or (c) the 
detection of the ASCM is not made. 

To amplify the meaning of the off page connectors, the 
following conventions apply. The acronym "fcs" represents 
"fire control solution", "cpds" represents "carrier point 
defense system" and "nel" translates to "not engageable". 
Lower case connectors move "down" the page and connect to 
minor subevents while upper case connectors generally move 
"across" the page and connect to major events or tiers. This 
convention is relaxed in Figure 4.7 where the connectors T5 
and T6 tie downward rather than across the page. 




Figure 4.4 ASCM OR LR BOMBER NOT ENGAGEABLE 
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Figure 4.5 ASCM PENETRATES SR SAM SHIP DEFENSE 
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B. SR SAM SHIP DEFENSE (TIER 2) 

SR SAM ship defense system events are connected to Fig- 
ure 4.1 by the "t 2'' connector. They are shown in Figure 4.5. 
Penetration of the ASCM through the SR SAM ship defense is 
similar in concept to the first tier. In general, a target 
(ASCM) must be present that has penetrated a previous tier 
and a fire control solution must be generated. The defensive 
platform can either fire or not fire at the ASCM, depending 
on the circumstances. One notable difference concerns the 
four events enclosed by the dashed line. It relates to the 
position of the ship. Since the ASCM is targeted for the 
carrier, ship positioning in the case of a SR SAM ship be- 
comes an issue. 

The four blocks represent the major subevent "SR SAM ship 
fires SAM at ASCM and misses". The events are connected by 
an AND gate. Thus all events must occur in order to have 
a firing. The first event, "FC solution ..." is supported 
by the contributory events listed in Figure 4.2. 

The second and third events (reading from left to right) 
appear to be similar structurally and semantically but are 
separated to emphasize the issue. Although one of the events 
places the SR SAM ship in the approximate location, in range 
and on the AAW axis for firing the SAM, the event is included 
as a necessary ingredient to the problem solution. If not 
positioned optimally, the probability of hitting the ASCM 
becomes less than desired. In addition to positioning, timing 
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Figure 4.6 ASCM PENETRATES LR SAM SHIP DEFENSE 
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the SAM launch is important. Consequently the event "ASCM 
within launch window of SR SAM ship" is included in this 
analysis . 

The fourth event enclosed in the dashed box in Figure 
4.5, "SR SAM ship fires SAM at ASCM and misses" is self ex- 
planatory. The remaining fault events displayed in this por- 
tion of the model are similar to those of the previous tier. 
Figure 4.1. 

C. LONG RANGE SAM SHIP DEFENSE (TIER 3) 

Long range SAM ship defense is shown in Figure 4.6 and 
connected to the SR SAM ship defense tier by the T3 connector. 
The entire complex of events is nearly identical to that for 
the SR SAM ship system. The problems associated with pre- 
venting further penetration of the ASCM are similar in either 
case, however the fire control solutions are somewhat differ- 
ent. Intercepting the ASCM in its cruise phase represents 
a problem that is difficult to solve. Further analysis of 
the cruise phase intercept is outside the scope of this work. 

D. CAP DEFENSE (TIER 4) 

Although the use of CAP aircraft to prevent penetration 
of an ASCM after launch is arguable from a practical stand- 
point, the event is included in the analysis because it re- 
presents a low probability extreme. To omit it from the model 
would be inappropriate. It is connected to the events of 
Tier 3 (LR SAM Ship Defense) by the "t 4" connector. For the 
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ASCM to penetrate through the CAP defenses it must initially 
have been launched by the LR Bomber at either a STANDOFF range 
or a REDUCED standoff range. These events are shown in Figure 
4.7. Once launched, it proceeds to high altitude through 
the interceptors defense. ASCM evasion of the CAP defenses 
is shown in Figure 4.8. It is joined to Figure 4.7 by the 
"asm" connector. 

Figure 4.8 is symmetrical, LR CAP and MR CAP have similar 
supporting events, however only the subevents associated with 
the MR CAP are shown. The connectors "Ircl" and "lrc2" (re- 
ferring to LR CAP) are used to expand the events that lead 
to "LR CAP does not fire" shown in Figure 4.9 or to "LR CAP 
fires AIM at ASCM and misses" shown in Figure 4.10. 

E. ASCM LAUNCHED FROM STANDOFF RANGE 

Consider the case where the long range bomber has target- 
ing information that will allow launching the ASCM from near 
maximum range. Figure 4.11 displays the contributing events 
that lead to ASCM launch at long range. Countertargeting 
by the battle force has been ineffective and the LR bomber 
proceeds to launch range while updating the targeting infor- 
mation. The ASCM is then launched and flies to its preassigned 
destination (carrier) autonomously. The details of the LR 
bomber evading the LR CAP are imbedded in Figure 4.11. It 
should be noted that the connectors "fcs" and "nel" support 
the events of this figure. 
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Figure 4.7 ASCM PENETRATES CAP DEFENSE TO INNER DEFENSE ZONE 

F. ASCM LAUNCHED FROM REDUCED RANGE 

This section deals primarily with the countertargeting 
problem encountered by the hostile force. As previously pos- 
tulated, it is the intention of the LR bomber to launch the 
missile at maximum range consistent with the quality of the 
targeting solution and the bomber's exposure to battle force 
interceptors. The events contributing to ASCM launch at REDUCED 
range are displayed in Figure 4.12. This figure integrates 
"degrees" of countertargeting into the problem. Countertar- 
geting is initially effective so the LR bomber continues inbound 
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Figure 4.8 ASCM EVADES CAP 
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Figure 4.9 LR CAP DOES NOT FIRE AT ASCM 



toward the carrier until either the LR bomber gains accurate 
targeting data (and launches) or the LR bomber encounters 
resistance with the outer air battle interceptors. Targeting 
range is not well defined in any case thus the supporting 
events to "ASCM launch at REDUCED range" are somewhat flex- 
ible. The connectors "lrc3" and "lrc4" join the subevents 
that relate to the firing or nonfiring of AIM's at the LR 
bomber. Similarly, "mrcl" and "mrc2" refer to medium range 
CAP events which relate to the firing or nonfiring of MR CAP 



48 




Figure 4,10 LR CAP FIRES AIM AND MISSES ASCM 



launched AIM's. The events that detail CAP launched missile 
firings at the LR bomber are shown in Figures 4.13 through 
4.16. 
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Figure 4.11 ASCM FIRED FROM STANDOFF RANGE 
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Figure 4.12 ASCM FIRED FROM REDUCED RANGE 
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Figure 4.13 LR CAP DOES NOT FIRE AT LR BOMBER 




Figure 4.14 



LR CAP FIRES AIM AT LR BOMBER 
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Figure 4.15 MR CAP DOES NOT FIRE AT LR BOMBER 
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Figure 4.16 



MR CAP FIRES AIM AT LR BOMBER 
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V. USEFULNESS AND CONCLUSIONS 



A. QUALITATIVE INSTRUCTIONAL TOOL 

At the outset of this work a discussion was initiated 
on the use of Fault Analysis as a quantitative predictor and 
a qualitative instructional tool. To illustrate these con- 
cepts an AAW scenario was introduced and fault tree analysis 
was applied to the model. 

The model was qualitatively developed using fault tree 
methodology to describe the flow of logic that is necessary 
to lead to mission failure. The mission in this case was 
to defend a carrier against ASM attack. 

The model is simple enough to use as an instructional 
device for primary students in naval warfare. It is robust 
enough to use as a diagnostic tool when analyzing the tactics 
that prevent the occurrence of the top event. 

The flow chart style of annotation in FTA is compatible 
with naval warfare scenarios. One of the features of a flow 
chart presentation is to enable a student client to gain an 
appreciation for the "big picture". By viewing the AAW sce- 
nario from the big picture vantage point it enables the oper- 
ator at the radar scope level to better understand the objective. 
This may have the added benefit of yielding more effective 
and reliable performance. 
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At the warfare commander level, the client is better able 
to identify critical combinations of successes (or failures) 
that can lead to a more efficient allocation of personnel and 
hardward in either a training or operational environment. 

As a visual tool, it can be used for communicating results 
and supporting decisions that might otherwise seem ambiguous. 

This AAW model has identified the "big picture" events that 
lead to a hit on the carrier. The model admits detailed analysis 
of the events that enter throughout the model, for example, the 
event "Command and control problem prevents firing AIM (LR or SR 
SAM) at ASCM" . The "command and control problem" at any stage 
is one of the more important inhibitors of efficient operations 
in naval warfare. It is also one of the most difficult to solve. 
Developing the failure event labeled "ComiiPand and control ..." 
may uncover a solution to the problem not before realized. In 
addition, a problem not initially recognized as a problem may 
emerge and coincidentally be solved. Just recognizing the pro- 
blem and being able to define it sometimes leads to a solution. 

Many events throughout the model are undeveloped. One 
of the features of FTA is that the model is developed top 
down. Undeveloped events can then be expanded by specialists 
using relevant experience and technical knowledge. For ex- 
ample, the event in Figure 4.2 "Fire control solution is gen- 
erated to hit the hostile target" is such an event. 

Little emphasis has been placed in the model on the elec- 
tronic measures conducted by the hostile platform to prevent 
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detection and destruction before launch of the ASCM. In real- 



ity this area receives considerable attention and it is of 
major importance to both sides. It is an event to which con- 
siderable thought and research has been devoted. A specialist 
in electronic warfare could develop the concepts (events) 
and provide further insight into the problem. 

Finally, by considering the "dual" of the fault tree or 
the success tree, event tree analysis can be a corroborative 
aid in operational planning. By developing the events that 
lead to the event "Carrier is not hit" (the complement of 
the model's top event) the warfare commander may encounter 
an aspect of the problem not previously viewed. 

B. QUANTITATIVE PREDICTIVE TOOL 

The objective of this work was to examine event tree 
analysis, and more specifically Fault Tree Analysis, when 
applied to an AAW scenario. The scenario was developed qual- 
itatively. The quantitative aspects of the analysis were 
not examined. The purpose of this section is to mention the 
quantitative possibilities in the FTA approach. 

Many models have been developed in AAW that use gaming 
and simulation methodology. Many of these models are used 
in the instructional environment to enhance a student's tac- 
tical ability to use and understand modern platforms and wea- 
pons. Imbedded in the games are probabilities (based on assumed 
distributions) of specific events occurring with the end result 
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(in this case) that the "Carrier is hit" or the "Carrier is 
not hit" depending on the tactic used and the final implicit 
probability . 

Proposed from this model is not so much the stochastic 
result, e.g., "with .05 probability, the carrier is hit" but 
in a broader sense the sensitivity of that result to various 
inputs or events. The model as presented is in some respects 
not usable for such an analysis. Given further embellishment 
however, it could be a useful tool in sensitivity studies. 

To help with the problem of where to place additional emphasis 
to reduce the probabilities associated with the end or inter- 
mediate results is certainly an inducement to use it in oper- 
ational planning. 

The issue here is in attempting to assign probabilities 
that are clearly subjective arguments on the state of the 
system. Many assumptions must be made to accomplish these 
assignments, including a problematic one about the indepen- 
dence of events. This would have to be done cautiously in 
order to preserve the usefulness of the sensitivity study. 

An example of how the Initial Scenario proposed in Chapter 
II, and described graphically in Figure 3.2 might be quanti- 
fied is given in APPENDIX A. A more detailed analysis is 
beyond the scope of this work. 
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C . OTHER SCENARIOS 



Other scenarios, analagous to AAW are aptly described 
by a fault tree or a success tree. Suppose similar scenarios 
were developed using the same degree of detail that was used 
in the AAW model. By exposing these trees to the critique 
of students and warfare commanders, the level of communica- 
tion and understanding at all echelons could be increased. 
Below are listed other warfare environments and scenarios 
that are amenable to analysis using event trees. 

1 . AAW 

• Submarine launched cruise missiles targeted for 
the carrier. 

• Surface launched cruise missiles targeted for the 
carrier . 

• Air-to-Air engagement . 

• SAM engagements. 

2 . Anti-Surface Warfare (ASUW) 

• Type engagements involving combat surface vessels. 

3 . Anti-Submarine Warfare (ASW) 

• Submarine versus submarine engagements. 

• Submarine versus surface ship engagement. 

• Surface ship versus submarine engagement. 

• Submarine versus antisubmarine aircraft engagement. 
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APPENDIX A 



PROBABILITY ANALYSIS OF THE INITIAL SCENARIO 

A typical probability analysis of the Initial Scenario 
would proceed along the lines as follows: 

Pjj = P (Carrier is hit) 

= P(Raid penetrates, missile is fired and hits) 

= P (Missile is fired and hits/ Raid penetrates) 

X P(Raid penetrates) 

* == Pr 

where 

Pj^ = P (Missile is fired and hits/Raid penetrates) 
is the conditional probability that the 
missile succeeds once it is within range 

and 

P„ = P(Raid penetrates) 

is the probability that the missile can 
be brought within range 

The fault tree for the Initial Scenario expresses the 
event H = (Carrier is hit) as the logical "and" of the event 
R = (Raid penetrates) and M = (Missile is fired and hits) . 

The event H is the consequence of transmitting the events 
R and M through the "and" gate. In the same vein, the pro- 
bability Pjj can be viewed as the result of transmitting the 
probabilities P^^ and P^^ through the "and" gate. 
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The success tree for the Initial Scenario relates the 
events H = (Carrier is not hit) to the events R = (Raid does 
not penetrate) and M = (Missile does not hit) . The events 
H, R, M are the logical opposites of the events H, R and M. 

The event H is the consequence of transmitting the events 
R and M through the "or" gate. The probability Pg can be 
viewed as the result of transmitting Pg and P^^^ through the 
"or" gate. 

It must be emphasized that the probability analysis pre- 
sented illustrates only the simplest cases. A probability 
analysis on the AAW scenario modeled in this work will re- 
quire some more difficult techniques. 
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